--- /dev/null
+From 0391359ddf79b52bb7e7bb9ace08e34fb08b0e76 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Mon, 8 Dec 2014 22:55:22 +0100
+Subject: drm/dp-mst: Remove branches before dropping the reference
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit 0391359ddf79b52bb7e7bb9ace08e34fb08b0e76 upstream.
+
+When we unplug a dp mst branch we unreference the entire tree from
+the root towards the leaves. Which is ok, since that's the way the
+pointers and so also the refcounts go.
+
+But when we drop the reference we must make sure that we remove the
+branches/ports from the lists/pointers before dropping the reference.
+Otherwise the get_validated functions will still return it instead
+of returning NULL (which indicates a potentially on-going unplug).
+
+The mst branch destroy gets this right for ports: First it deletes
+the port from the ports list, then it unrefs. But the ports destroy
+function gets it wrong: First it unrefs, then it drops the ref. Which
+means a zombie mst branch can still be validate with get_validated_mstb_ref
+when it shouldn't.
+
+Fix this.
+
+This should address a backtrace Dave dug out somewhere on unplug:
+
+ [<ffffffffa00cc262>] drm_dp_mst_get_validated_mstb_ref_locked+0x92/0xa0 [drm_kms_helper]
+ [<ffffffffa00cc211>] drm_dp_mst_get_validated_mstb_ref_locked+0x41/0xa0 [drm_kms_helper]
+ [<ffffffffa00cc2aa>] drm_dp_get_validated_mstb_ref+0x3a/0x60 [drm_kms_helper]
+ [<ffffffffa00cc2fb>] drm_dp_payload_send_msg.isra.14+0x2b/0x100 [drm_kms_helper]
+ [<ffffffffa00cc547>] drm_dp_update_payload_part1+0x177/0x360 [drm_kms_helper]
+ [<ffffffffa015c52e>] intel_mst_disable_dp+0x3e/0x80 [i915]
+ [<ffffffffa013d60b>] haswell_crtc_disable+0x1cb/0x340 [i915]
+ [<ffffffffa0136739>] intel_crtc_control+0x49/0x100 [i915]
+ [<ffffffffa0136857>] intel_crtc_update_dpms+0x67/0x80 [i915]
+ [<ffffffffa013fa59>] intel_connector_dpms+0x59/0x70 [i915]
+ [<ffffffffa015c752>] intel_dp_destroy_mst_connector+0x32/0xc0 [i915]
+ [<ffffffffa00cb44b>] drm_dp_destroy_port+0x6b/0xa0 [drm_kms_helper]
+ [<ffffffffa00cb588>] drm_dp_destroy_mst_branch_device+0x108/0x130 [drm_kms_helper]
+ [<ffffffffa00cb3cd>] drm_dp_port_teardown_pdt+0x3d/0x50 [drm_kms_helper]
+ [<ffffffffa00cdb79>] drm_dp_mst_handle_up_req+0x499/0x540 [drm_kms_helper]
+ [<ffffffff810d9ead>] ? trace_hardirqs_on_caller+0x15d/0x200 [<ffffffffa00cdc73>]
+ drm_dp_mst_hpd_irq+0x53/0xa00 [drm_kms_helper] [<ffffffffa00c7dfb>]
+ ? drm_dp_dpcd_read+0x1b/0x20 [drm_kms_helper] [<ffffffffa0153ed8>]
+ ? intel_dp_dpcd_read_wake+0x38/0x70 [i915] [<ffffffffa015a225>]
+ intel_dp_check_mst_status+0xb5/0x250 [i915] [<ffffffffa015ac71>]
+ intel_dp_hpd_pulse+0x181/0x210 [i915] [<ffffffffa01104f6>]
+ i915_digport_work_func+0x96/0x120 [i915]
+
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -839,6 +839,8 @@ static void drm_dp_put_mst_branch_device
+
+ static void drm_dp_port_teardown_pdt(struct drm_dp_mst_port *port, int old_pdt)
+ {
++ struct drm_dp_mst_branch *mstb;
++
+ switch (old_pdt) {
+ case DP_PEER_DEVICE_DP_LEGACY_CONV:
+ case DP_PEER_DEVICE_SST_SINK:
+@@ -846,8 +848,9 @@ static void drm_dp_port_teardown_pdt(str
+ drm_dp_mst_unregister_i2c_bus(&port->aux);
+ break;
+ case DP_PEER_DEVICE_MST_BRANCHING:
+- drm_dp_put_mst_branch_device(port->mstb);
++ mstb = port->mstb;
+ port->mstb = NULL;
++ drm_dp_put_mst_branch_device(mstb);
+ break;
+ }
+ }
--- /dev/null
+From 19a93f042fc241ecdf98543cedfe7c171f8cdf53 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Wed, 26 Nov 2014 13:13:09 +1000
+Subject: drm/dp: retry AUX transactions 32 times (v1.1)
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit 19a93f042fc241ecdf98543cedfe7c171f8cdf53 upstream.
+
+At least on two MST devices I've tested with, when
+they are link training downstream, they are totally
+unable to handle aux ch msgs, so they defer like nuts.
+I tried 16, it wasn't enough, 32 seems better.
+
+This fixes one Dell 4k monitor and one of the
+MST hubs.
+
+v1.1: fixup comment (Tom).
+
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_dp_helper.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/drm_dp_helper.c
++++ b/drivers/gpu/drm/drm_dp_helper.c
+@@ -378,10 +378,11 @@ static int drm_dp_dpcd_access(struct drm
+
+ /*
+ * The specification doesn't give any recommendation on how often to
+- * retry native transactions, so retry 7 times like for I2C-over-AUX
+- * transactions.
++ * retry native transactions. We used to retry 7 times like for
++ * aux i2c transactions but real world devices this wasn't
++ * sufficient, bump to 32 which makes Dell 4k monitors happier.
+ */
+- for (retry = 0; retry < 7; retry++) {
++ for (retry = 0; retry < 32; retry++) {
+
+ mutex_lock(&aux->hw_mutex);
+ err = aux->transfer(aux, &msg);
--- /dev/null
+From e2809c7db818df6bbd0edf843e1beb2fbc9d8541 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Wed, 26 Nov 2014 13:15:24 +1000
+Subject: drm/fb_helper: move deferred fb checking into restore mode (v2)
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit e2809c7db818df6bbd0edf843e1beb2fbc9d8541 upstream.
+
+On MST systems the monitors don't appear when we set the fb up,
+but plymouth opens the drm device and holds it open while they
+come up, when plymouth finishes and lastclose gets called we
+don't do the delayed fb probe, so the monitor never appears on the
+console.
+
+Fix this by moving the delayed checking into the mode restore.
+
+v2: Daniel suggested that ->delayed_hotplug is set under
+the mode_config mutex, so we should check it under that as
+well, while we are in the area.
+
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_fb_helper.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -347,9 +347,18 @@ bool drm_fb_helper_restore_fbdev_mode_un
+ {
+ struct drm_device *dev = fb_helper->dev;
+ bool ret;
++ bool do_delayed = false;
++
+ drm_modeset_lock_all(dev);
+ ret = restore_fbdev_mode(fb_helper);
++
++ do_delayed = fb_helper->delayed_hotplug;
++ if (do_delayed)
++ fb_helper->delayed_hotplug = false;
+ drm_modeset_unlock_all(dev);
++
++ if (do_delayed)
++ drm_fb_helper_hotplug_event(fb_helper);
+ return ret;
+ }
+ EXPORT_SYMBOL(drm_fb_helper_restore_fbdev_mode_unlocked);
+@@ -888,10 +897,6 @@ int drm_fb_helper_set_par(struct fb_info
+
+ drm_fb_helper_restore_fbdev_mode_unlocked(fb_helper);
+
+- if (fb_helper->delayed_hotplug) {
+- fb_helper->delayed_hotplug = false;
+- drm_fb_helper_hotplug_event(fb_helper);
+- }
+ return 0;
+ }
+ EXPORT_SYMBOL(drm_fb_helper_set_par);
--- /dev/null
+From 02ae7af53a451a1b0a51022c4693f5b339133e79 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Dec 2014 17:24:19 -0500
+Subject: drm/radeon: adjust default bapm settings for KV
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 02ae7af53a451a1b0a51022c4693f5b339133e79 upstream.
+
+Enabling bapm seems to cause clocking problems on some
+KV configurations. Disable it by default for now.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/kv_dpm.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/kv_dpm.c
++++ b/drivers/gpu/drm/radeon/kv_dpm.c
+@@ -2745,13 +2745,11 @@ int kv_dpm_init(struct radeon_device *rd
+ pi->enable_auto_thermal_throttling = true;
+ pi->disable_nb_ps3_in_battery = false;
+ if (radeon_bapm == -1) {
+- /* There are stability issues reported on with
+- * bapm enabled on an asrock system.
+- */
+- if (rdev->pdev->subsystem_vendor == 0x1849)
+- pi->bapm_enable = false;
+- else
++ /* only enable bapm on KB, ML by default */
++ if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS)
+ pi->bapm_enable = true;
++ else
++ pi->bapm_enable = false;
+ } else if (radeon_bapm == 0) {
+ pi->bapm_enable = false;
+ } else {
--- /dev/null
+From 5e5c21cac1001089007260c48b0c89ebaace0e71 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 3 Dec 2014 00:03:49 -0500
+Subject: drm/radeon: check the right ring in radeon_evict_flags()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 5e5c21cac1001089007260c48b0c89ebaace0e71 upstream.
+
+Check the that ring we are using for copies is functional
+rather than the GFX ring. On newer asics we use the DMA
+ring for bo moves.
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_ttm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -196,7 +196,7 @@ static void radeon_evict_flags(struct tt
+ rbo = container_of(bo, struct radeon_bo, tbo);
+ switch (bo->mem.mem_type) {
+ case TTM_PL_VRAM:
+- if (rbo->rdev->ring[RADEON_RING_TYPE_GFX_INDEX].ready == false)
++ if (rbo->rdev->ring[radeon_copy_ring_index(rbo->rdev)].ready == false)
+ radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_CPU);
+ else
+ radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT);
--- /dev/null
+From 5665c3ebe5ee8a2c516925461f7214ba59c2e6d7 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 9 Dec 2014 10:04:01 -0500
+Subject: drm/radeon: fix sad_count check for dce3
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 5665c3ebe5ee8a2c516925461f7214ba59c2e6d7 upstream.
+
+Make it consistent with the sad code for other asics to deal
+with monitors that don't report sads.
+
+bug:
+https://bugzilla.kernel.org/show_bug.cgi?id=89461
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/dce3_1_afmt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/dce3_1_afmt.c
++++ b/drivers/gpu/drm/radeon/dce3_1_afmt.c
+@@ -103,7 +103,7 @@ static void dce3_2_afmt_write_sad_regs(s
+ }
+
+ sad_count = drm_edid_to_sad(radeon_connector->edid, &sads);
+- if (sad_count < 0) {
++ if (sad_count <= 0) {
+ DRM_ERROR("Couldn't read SADs: %d\n", sad_count);
+ return;
+ }
--- /dev/null
+From 129acb7c0b682512e89c4f65c33593d50f2f49a9 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 7 Nov 2014 11:05:04 -0500
+Subject: drm/radeon: fix typo in CI dpm disable
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 129acb7c0b682512e89c4f65c33593d50f2f49a9 upstream.
+
+Need to disable DS, not enable it when disabling dpm.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/ci_dpm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/ci_dpm.c
++++ b/drivers/gpu/drm/radeon/ci_dpm.c
+@@ -4729,7 +4729,7 @@ void ci_dpm_disable(struct radeon_device
+ ci_enable_spread_spectrum(rdev, false);
+ ci_enable_auto_throttle_source(rdev, RADEON_DPM_AUTO_THROTTLE_SRC_THERMAL, false);
+ ci_stop_dpm(rdev);
+- ci_enable_ds_master_switch(rdev, true);
++ ci_enable_ds_master_switch(rdev, false);
+ ci_enable_ulv(rdev, false);
+ ci_clear_vc(rdev);
+ ci_reset_to_default(rdev);
--- /dev/null
+From fbedf1c3fc3a1e9f249c2efe2f4553d8df9d86d3 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 5 Dec 2014 13:46:07 -0500
+Subject: drm/radeon: KV has three PPLLs (v2)
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit fbedf1c3fc3a1e9f249c2efe2f4553d8df9d86d3 upstream.
+
+Enable all three in the driver. Early documentation
+indicated the 3rd one was used for something else, but
+that is not the case.
+
+v2: handle disable as well
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/atombios_crtc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -1851,10 +1851,9 @@ static int radeon_atom_pick_pll(struct d
+ return pll;
+ }
+ /* otherwise, pick one of the plls */
+- if ((rdev->family == CHIP_KAVERI) ||
+- (rdev->family == CHIP_KABINI) ||
++ if ((rdev->family == CHIP_KABINI) ||
+ (rdev->family == CHIP_MULLINS)) {
+- /* KB/KV/ML has PPLL1 and PPLL2 */
++ /* KB/ML has PPLL1 and PPLL2 */
+ pll_in_use = radeon_get_pll_use_mask(crtc);
+ if (!(pll_in_use & (1 << ATOM_PPLL2)))
+ return ATOM_PPLL2;
+@@ -1863,7 +1862,7 @@ static int radeon_atom_pick_pll(struct d
+ DRM_ERROR("unable to allocate a PPLL\n");
+ return ATOM_PPLL_INVALID;
+ } else {
+- /* CI has PPLL0, PPLL1, and PPLL2 */
++ /* CI/KV has PPLL0, PPLL1, and PPLL2 */
+ pll_in_use = radeon_get_pll_use_mask(crtc);
+ if (!(pll_in_use & (1 << ATOM_PPLL2)))
+ return ATOM_PPLL2;
+@@ -2154,6 +2153,7 @@ static void atombios_crtc_disable(struct
+ case ATOM_PPLL0:
+ /* disable the ppll */
+ if ((rdev->family == CHIP_ARUBA) ||
++ (rdev->family == CHIP_KAVERI) ||
+ (rdev->family == CHIP_BONAIRE) ||
+ (rdev->family == CHIP_HAWAII))
+ atombios_crtc_program_pll(crtc, radeon_crtc->crtc_id, radeon_crtc->pll_id,
--- /dev/null
+From 410cce2a6b82299b46ff316c6384e789ce275ecb Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 10 Dec 2014 09:42:10 -0500
+Subject: drm/radeon: properly filter DP1.2 4k modes on non-DP1.2 hw
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 410cce2a6b82299b46ff316c6384e789ce275ecb upstream.
+
+The check was already in place in the dp mode_valid check, but
+radeon_dp_get_dp_link_clock() never returned the high clock
+mode_valid was checking for because that function clipped the
+clock based on the hw capabilities. Add an explicit check
+in the mode_valid function.
+
+bug:
+https://bugs.freedesktop.org/show_bug.cgi?id=87172
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/atombios_dp.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -492,6 +492,10 @@ int radeon_dp_mode_valid_helper(struct d
+ struct radeon_connector_atom_dig *dig_connector;
+ int dp_clock;
+
++ if ((mode->clock > 340000) &&
++ (!radeon_connector_is_dp12_capable(connector)))
++ return MODE_CLOCK_HIGH;
++
+ if (!radeon_connector->con_priv)
+ return MODE_CLOCK_HIGH;
+ dig_connector = radeon_connector->con_priv;
--- /dev/null
+From 4bb62c95a7e781a238b2ab374f34b1bf91e01ddc Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 17 Nov 2014 15:08:17 -0500
+Subject: drm/radeon: work around a hw bug in MGCG on CIK
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 4bb62c95a7e781a238b2ab374f34b1bf91e01ddc upstream.
+
+Always need to set bit 0 of RLC_CGTT_MGCG_OVERRIDE
+to avoid unreliable doorbell updates in some cases.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/cik.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -6314,6 +6314,7 @@ static void cik_enable_mgcg(struct radeo
+ }
+
+ orig = data = RREG32(RLC_CGTT_MGCG_OVERRIDE);
++ data |= 0x00000001;
+ data &= 0xfffffffd;
+ if (orig != data)
+ WREG32(RLC_CGTT_MGCG_OVERRIDE, data);
+@@ -6345,7 +6346,7 @@ static void cik_enable_mgcg(struct radeo
+ }
+ } else {
+ orig = data = RREG32(RLC_CGTT_MGCG_OVERRIDE);
+- data |= 0x00000002;
++ data |= 0x00000003;
+ if (orig != data)
+ WREG32(RLC_CGTT_MGCG_OVERRIDE, data);
+
--- /dev/null
+From 881fdaa5e4cb0d68e52acab0ad4e1820e2bfffa4 Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Thu, 13 Nov 2014 22:43:23 +0900
+Subject: drm/ttm: Avoid memory allocation from shrinker functions.
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+commit 881fdaa5e4cb0d68e52acab0ad4e1820e2bfffa4 upstream.
+
+Andrew Morton wrote:
+> On Wed, 12 Nov 2014 13:08:55 +0900 Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp> wrote:
+>
+> > Andrew Morton wrote:
+> > > Poor ttm guys - this is a bit of a trap we set for them.
+> >
+> > Commit a91576d7916f6cce ("drm/ttm: Pass GFP flags in order to avoid deadlock.")
+> > changed to use sc->gfp_mask rather than GFP_KERNEL.
+> >
+> > - pages_to_free = kmalloc(npages_to_free * sizeof(struct page *),
+> > - GFP_KERNEL);
+> > + pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp);
+> >
+> > But this bug is caused by sc->gfp_mask containing some flags which are not
+> > in GFP_KERNEL, right? Then, I think
+> >
+> > - pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp);
+> > + pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp & GFP_KERNEL);
+> >
+> > would hide this bug.
+> >
+> > But I think we should use GFP_ATOMIC (or drop __GFP_WAIT flag)
+>
+> Well no - ttm_page_pool_free() should stop calling kmalloc altogether.
+> Just do
+>
+> struct page *pages_to_free[16];
+>
+> and rework the code to free 16 pages at a time. Easy.
+
+Well, ttm code wants to process 512 pages at a time for performance.
+Memory footprint increased by 512 * sizeof(struct page *) buffer is
+only 4096 bytes. What about using static buffer like below?
+----------
+>From d3cb5393c9c8099d6b37e769f78c31af1541fe8c Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Thu, 13 Nov 2014 22:21:54 +0900
+Subject: drm/ttm: Avoid memory allocation from shrinker functions.
+
+Commit a91576d7916f6cce ("drm/ttm: Pass GFP flags in order to avoid
+deadlock.") caused BUG_ON() due to sc->gfp_mask containing flags
+which are not in GFP_KERNEL.
+
+ https://bugzilla.kernel.org/show_bug.cgi?id=87891
+
+Changing from sc->gfp_mask to (sc->gfp_mask & GFP_KERNEL) would
+avoid the BUG_ON(), but avoiding memory allocation from shrinker
+function is better and reliable fix.
+
+Shrinker function is already serialized by global lock, and
+clean up function is called after shrinker function is unregistered.
+Thus, we can use static buffer when called from shrinker function
+and clean up function.
+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/ttm/ttm_page_alloc.c | 26 +++++++++++++++-----------
+ drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 25 +++++++++++++++----------
+ 2 files changed, 30 insertions(+), 21 deletions(-)
+
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+@@ -297,11 +297,12 @@ static void ttm_pool_update_free_locked(
+ *
+ * @pool: to free the pages from
+ * @free_all: If set to true will free all pages in pool
+- * @gfp: GFP flags.
++ * @use_static: Safe to use static buffer
+ **/
+ static int ttm_page_pool_free(struct ttm_page_pool *pool, unsigned nr_free,
+- gfp_t gfp)
++ bool use_static)
+ {
++ static struct page *static_buf[NUM_PAGES_TO_ALLOC];
+ unsigned long irq_flags;
+ struct page *p;
+ struct page **pages_to_free;
+@@ -311,7 +312,11 @@ static int ttm_page_pool_free(struct ttm
+ if (NUM_PAGES_TO_ALLOC < nr_free)
+ npages_to_free = NUM_PAGES_TO_ALLOC;
+
+- pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp);
++ if (use_static)
++ pages_to_free = static_buf;
++ else
++ pages_to_free = kmalloc(npages_to_free * sizeof(struct page *),
++ GFP_KERNEL);
+ if (!pages_to_free) {
+ pr_err("Failed to allocate memory for pool free operation\n");
+ return 0;
+@@ -374,7 +379,8 @@ restart:
+ if (freed_pages)
+ ttm_pages_put(pages_to_free, freed_pages);
+ out:
+- kfree(pages_to_free);
++ if (pages_to_free != static_buf)
++ kfree(pages_to_free);
+ return nr_free;
+ }
+
+@@ -383,8 +389,6 @@ out:
+ *
+ * XXX: (dchinner) Deadlock warning!
+ *
+- * We need to pass sc->gfp_mask to ttm_page_pool_free().
+- *
+ * This code is crying out for a shrinker per pool....
+ */
+ static unsigned long
+@@ -407,8 +411,8 @@ ttm_pool_shrink_scan(struct shrinker *sh
+ if (shrink_pages == 0)
+ break;
+ pool = &_manager->pools[(i + pool_offset)%NUM_POOLS];
+- shrink_pages = ttm_page_pool_free(pool, nr_free,
+- sc->gfp_mask);
++ /* OK to use static buffer since global mutex is held. */
++ shrink_pages = ttm_page_pool_free(pool, nr_free, true);
+ freed += nr_free - shrink_pages;
+ }
+ mutex_unlock(&lock);
+@@ -710,7 +714,7 @@ static void ttm_put_pages(struct page **
+ }
+ spin_unlock_irqrestore(&pool->lock, irq_flags);
+ if (npages)
+- ttm_page_pool_free(pool, npages, GFP_KERNEL);
++ ttm_page_pool_free(pool, npages, false);
+ }
+
+ /*
+@@ -849,9 +853,9 @@ void ttm_page_alloc_fini(void)
+ pr_info("Finalizing pool allocator\n");
+ ttm_pool_mm_shrink_fini(_manager);
+
++ /* OK to use static buffer since global mutex is no longer used. */
+ for (i = 0; i < NUM_POOLS; ++i)
+- ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES,
+- GFP_KERNEL);
++ ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES, true);
+
+ kobject_put(&_manager->kobj);
+ _manager = NULL;
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+@@ -411,11 +411,12 @@ static void ttm_dma_page_put(struct dma_
+ *
+ * @pool: to free the pages from
+ * @nr_free: If set to true will free all pages in pool
+- * @gfp: GFP flags.
++ * @use_static: Safe to use static buffer
+ **/
+ static unsigned ttm_dma_page_pool_free(struct dma_pool *pool, unsigned nr_free,
+- gfp_t gfp)
++ bool use_static)
+ {
++ static struct page *static_buf[NUM_PAGES_TO_ALLOC];
+ unsigned long irq_flags;
+ struct dma_page *dma_p, *tmp;
+ struct page **pages_to_free;
+@@ -432,7 +433,11 @@ static unsigned ttm_dma_page_pool_free(s
+ npages_to_free, nr_free);
+ }
+ #endif
+- pages_to_free = kmalloc(npages_to_free * sizeof(struct page *), gfp);
++ if (use_static)
++ pages_to_free = static_buf;
++ else
++ pages_to_free = kmalloc(npages_to_free * sizeof(struct page *),
++ GFP_KERNEL);
+
+ if (!pages_to_free) {
+ pr_err("%s: Failed to allocate memory for pool free operation\n",
+@@ -502,7 +507,8 @@ restart:
+ if (freed_pages)
+ ttm_dma_pages_put(pool, &d_pages, pages_to_free, freed_pages);
+ out:
+- kfree(pages_to_free);
++ if (pages_to_free != static_buf)
++ kfree(pages_to_free);
+ return nr_free;
+ }
+
+@@ -531,7 +537,8 @@ static void ttm_dma_free_pool(struct dev
+ if (pool->type != type)
+ continue;
+ /* Takes a spinlock.. */
+- ttm_dma_page_pool_free(pool, FREE_ALL_PAGES, GFP_KERNEL);
++ /* OK to use static buffer since global mutex is held. */
++ ttm_dma_page_pool_free(pool, FREE_ALL_PAGES, true);
+ WARN_ON(((pool->npages_in_use + pool->npages_free) != 0));
+ /* This code path is called after _all_ references to the
+ * struct device has been dropped - so nobody should be
+@@ -986,7 +993,7 @@ void ttm_dma_unpopulate(struct ttm_dma_t
+
+ /* shrink pool if necessary (only on !is_cached pools)*/
+ if (npages)
+- ttm_dma_page_pool_free(pool, npages, GFP_KERNEL);
++ ttm_dma_page_pool_free(pool, npages, false);
+ ttm->state = tt_unpopulated;
+ }
+ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);
+@@ -996,8 +1003,6 @@ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);
+ *
+ * XXX: (dchinner) Deadlock warning!
+ *
+- * We need to pass sc->gfp_mask to ttm_dma_page_pool_free().
+- *
+ * I'm getting sadder as I hear more pathetical whimpers about needing per-pool
+ * shrinkers
+ */
+@@ -1030,8 +1035,8 @@ ttm_dma_pool_shrink_scan(struct shrinker
+ if (++idx < pool_offset)
+ continue;
+ nr_free = shrink_pages;
+- shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free,
+- sc->gfp_mask);
++ /* OK to use static buffer since global mutex is held. */
++ shrink_pages = ttm_dma_page_pool_free(p->pool, nr_free, true);
+ freed += nr_free - shrink_pages;
+
+ pr_debug("%s: (%s:%d) Asked to shrink %d, have %d more to go\n",
--- /dev/null
+From 1f563a6a46544602183e7493b6ef69769d3d76d9 Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Tue, 2 Dec 2014 03:32:24 -0800
+Subject: drm/vmwgfx: Don't use memory accounting for kernel-side fence objects
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit 1f563a6a46544602183e7493b6ef69769d3d76d9 upstream.
+
+Kernel side fence objects are used when unbinding resources and may thus be
+created as part of a memory reclaim operation. This might trigger recursive
+memory reclaims and result in the kernel running out of stack space.
+
+So a simple way out is to avoid accounting of these fence objects.
+In principle this is OK since while user-space can trigger the creation of
+such objects, it can't really hold on to them. However, their lifetime is
+quite long, so some form of accounting should perhaps be implemented in the
+future.
+
+Fixes kernel crashes when running, for example viewperf11 ensight-04 test 3
+with low system memory settings.
+
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
+Reviewed-by: Sinclair Yeh <syeh@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 22 ++--------------------
+ 1 file changed, 2 insertions(+), 20 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+@@ -545,35 +545,19 @@ void vmw_fence_obj_flush(struct vmw_fenc
+
+ static void vmw_fence_destroy(struct vmw_fence_obj *fence)
+ {
+- struct vmw_fence_manager *fman = fman_from_fence(fence);
+-
+ fence_free(&fence->base);
+-
+- /*
+- * Free kernel space accounting.
+- */
+- ttm_mem_global_free(vmw_mem_glob(fman->dev_priv),
+- fman->fence_size);
+ }
+
+ int vmw_fence_create(struct vmw_fence_manager *fman,
+ uint32_t seqno,
+ struct vmw_fence_obj **p_fence)
+ {
+- struct ttm_mem_global *mem_glob = vmw_mem_glob(fman->dev_priv);
+ struct vmw_fence_obj *fence;
+ int ret;
+
+- ret = ttm_mem_global_alloc(mem_glob, fman->fence_size,
+- false, false);
+- if (unlikely(ret != 0))
+- return ret;
+-
+ fence = kzalloc(sizeof(*fence), GFP_KERNEL);
+- if (unlikely(fence == NULL)) {
+- ret = -ENOMEM;
+- goto out_no_object;
+- }
++ if (unlikely(fence == NULL))
++ return -ENOMEM;
+
+ ret = vmw_fence_obj_init(fman, fence, seqno,
+ vmw_fence_destroy);
+@@ -585,8 +569,6 @@ int vmw_fence_create(struct vmw_fence_ma
+
+ out_err_init:
+ kfree(fence);
+-out_no_object:
+- ttm_mem_global_free(mem_glob, fman->fence_size);
+ return ret;
+ }
+
--- /dev/null
+From e338c4c2b620ba4e75fd3576f8142eb93be12ce3 Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Tue, 25 Nov 2014 08:20:05 +0100
+Subject: drm/vmwgfx: Fix error printout on signals pending
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit e338c4c2b620ba4e75fd3576f8142eb93be12ce3 upstream.
+
+The function vmw_master_check() might return -ERESTARTSYS if there is a
+signal pending, indicating that the IOCTL should be rerun, potentially from
+user-space. At that point we shouldn't print out an error message since that
+is not an error condition. In short, avoid bloating the kernel log when a
+process refuses to die on SIGTERM.
+
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -1063,8 +1063,12 @@ static long vmw_generic_ioctl(struct fil
+
+ vmaster = vmw_master_check(dev, file_priv, flags);
+ if (unlikely(IS_ERR(vmaster))) {
+- DRM_INFO("IOCTL ERROR %d\n", nr);
+- return PTR_ERR(vmaster);
++ ret = PTR_ERR(vmaster);
++
++ if (ret != -ERESTARTSYS)
++ DRM_INFO("IOCTL ERROR Command %d, Error %ld.\n",
++ nr, ret);
++ return ret;
+ }
+
+ ret = ioctl_func(filp, cmd, arg);
--- /dev/null
+From 89669e7a7f96be3ee8d9a22a071d7c0d3b4428fc Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Tue, 2 Dec 2014 03:36:57 -0800
+Subject: drm/vmwgfx: Fix fence event code
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit 89669e7a7f96be3ee8d9a22a071d7c0d3b4428fc upstream.
+
+The commit "vmwgfx: Rework fence event action" introduced a number of bugs
+that are fixed with this commit:
+
+a) A forgotten return stateemnt.
+b) An if statement with identical branches.
+
+Reported-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
+Reviewed-by: Sinclair Yeh <syeh@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+@@ -1087,6 +1087,8 @@ static int vmw_event_fence_action_create
+ if (ret != 0)
+ goto out_no_queue;
+
++ return 0;
++
+ out_no_queue:
+ event->base.destroy(&event->base);
+ out_no_event:
+@@ -1162,17 +1164,10 @@ int vmw_fence_event_ioctl(struct drm_dev
+
+ BUG_ON(fence == NULL);
+
+- if (arg->flags & DRM_VMW_FE_FLAG_REQ_TIME)
+- ret = vmw_event_fence_action_create(file_priv, fence,
+- arg->flags,
+- arg->user_data,
+- true);
+- else
+- ret = vmw_event_fence_action_create(file_priv, fence,
+- arg->flags,
+- arg->user_data,
+- true);
+-
++ ret = vmw_event_fence_action_create(file_priv, fence,
++ arg->flags,
++ arg->user_data,
++ true);
+ if (unlikely(ret != 0)) {
+ if (ret != -ERESTARTSYS)
+ DRM_ERROR("Failed to attach event to fence.\n");
alx-fix-alx_poll.patch
team-avoid-possible-underflow-of-count_pending-value-for-notify_peers-and-mcast_rejoin.patch
enic-fix-rx-skb-checksum.patch
+drm-vmwgfx-don-t-use-memory-accounting-for-kernel-side-fence-objects.patch
+drm-vmwgfx-fix-error-printout-on-signals-pending.patch
+drm-vmwgfx-fix-fence-event-code.patch
+drm-ttm-avoid-memory-allocation-from-shrinker-functions.patch
+drm-fb_helper-move-deferred-fb-checking-into-restore-mode-v2.patch
+drm-dp-retry-aux-transactions-32-times-v1.1.patch
+drm-dp-mst-remove-branches-before-dropping-the-reference.patch
+drm-radeon-fix-typo-in-ci-dpm-disable.patch
+drm-radeon-work-around-a-hw-bug-in-mgcg-on-cik.patch
+drm-radeon-check-the-right-ring-in-radeon_evict_flags.patch
+drm-radeon-kv-has-three-pplls-v2.patch
+drm-radeon-fix-sad_count-check-for-dce3.patch
+drm-radeon-adjust-default-bapm-settings-for-kv.patch
+drm-radeon-properly-filter-dp1.2-4k-modes-on-non-dp1.2-hw.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
